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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 



WILLIAM A. MORGAN, JR., P.C, 
Plaintiff, 



V, 



SUSAN WISWELL, 
ANGELA MURPHY, 



Defendants. 



CIVIL ACTION NO. 



MEMORANDUM IN SUPPORT OF PLAINTIFF'S MOTION FOR 
TEMPORARY RESTRAINING ORDER AND PRELIMINARY INJUNCTION 

I. INTRODUCTION 

Defendants Susan Wiswell ("Wiswell") and Angela Murphy ("Murphy") were formerly 
employed by Plaintiff William A. Morgan, Jr., P.C. ("Morgan"). Prior to and since terminating 
their employment with Morgan, Wiswell and Murphy, acting in concert with each other and 
possibly other unknown defendants (the "John Does Defendants"), gained unauthorized access to 
their former email accounts at Morgan and the email accounts of other Morgan employees. 
Defendants also tampered with the email accounts of Morgan's president and vice president by 
setting up automatic forwarding rules intended to cause copies of email correspondence for these 
accounts to be intercepted and forwarded by blind copy to Defendants' two Yahoo! email 
accounts. 

Even after Morgan took steps to prevent them from gaining access. Defendants have 
persisted in their relentless attempts to hack into Morgan's email system remotely through the 
Internet, including more than 110 such attempts over the last eight weeks. These unauthorized 
attempts originate from Internet Protocol (IP) Addresses owned by Wiswell' s current employer 
(another accounting firm) and associated with emails from Wiswell' s personal email account. 

Most alarming, the nature and frequency of these failed attempts indicate that Defendants 
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are using a password cracker program to hack into Morgan's email system. Without immediate 
injunctive relief, it is only a matter of time before Defendants succeed in breaching the security of 
Morgan's email system. 

Defendants have also engaged in a concerted effort to interfere with Morgan's ability to 
hire new employees and to conduct its business in the wake of Wiswell's and Murphy's abrupt 
departures. They have deleted emails in Morgan's emails accounts from legitimate job candidates, 
sent fictitious resumes to Morgan and scheduled interviews for which no one would appear, and 
made false statements about Morgan that have caused problems with at least one of its clients. 

Defendants' conduct violates numerous laws and gives rise to several claims on which 
Morgan is substantially likely to succeed at trial. Defendants have caused, and unless enjoined 
will continue to cause, irreparable harm to Morgan's goodwill and reputation. The injunction 
Morgan seeks will not substantially injure Defendants, but will serve the public's interest in 
discouraging such wrongful behavior, insuring the privacy, stability, and integrity of Morgan's 
electronic communications and computer systems, and preventing the disclosure and use of 
Morgan's confidential business information and the private financial information of Morgan's 
chents. 
11. STATEMENT OF FACTS' 

A. Morgan's Accounting Services and its Employment of Wiswell and Murphy 

William A. Morgan, Jr., PC ("Morgan") is a CPA firm providing accounting and tax 
services to various high net worth individuals and businesses in the metropolitan DC area. Mr. 
William Morgan is President of Morgan, and Ms. Merritt Wingate is Vice President of Morgan. 



' The facts supporting Plaintiffs Motion for TRO and Memorandum in support are set forth fully in the Verified 
Complaint and the declarations of William Morgan ("Morgan Declaration"), Merritt Wingate ("Wingate 
Declaration"), Alex Rosenbaum ("Rosenbaum Declaration"), Natalia Lamb ("Lamb Declaration"), and Marci 
Vergillo ("Vergillo Declaration"). 
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Ms. Wingate's primary responsibilities include scheduling the accounting and tax work done for 
clients, supervising the accounting staff, preparing the tax returns for a number of large clients, and 
reviewing most of the accounting and tax work done by the rest of the accounting staff. 

Morgan uses the Group Wise® email system. Once logged into a GroupWise® email 
account, a user can read, copy, alter, print, or delete, any message in that user's folders. (Ex. A, 
Rosenbaum Declaration, f 9.) If the user is also logged into Morgan's computer network, the user 
can access and transmit documents to other accounts outside of Morgan's offices by attaching the 
document to an email message. A user with administrative rights, such as an office manager, 
would have access to all documents in Morgan's computer system. (Ex. A, Rosenbaum 
Declaration, ^ 1 1 ; Ex. B, Wingate Declaration, f 5.) Morgan instituted an email policy on or about 
June 2, 2002. (Ex. B, Wingate Declaration, % 4.) A copy of that policy is attached as Exhibit 1 to 
the Declaration of Merritt Wingate. The policy states that Morgan's computers and email system, 
and any communications prepared using the firm's computers and email system, are Morgan's 
property and are to be used only for Morgan's business purposes. 

As pertinent here, Morgan uses passwords to protect its computer network and email 
system. Each Morgan employee has a NetWare® password to Morgan's computer network and a 
GroupWise® password to Morgan's email system. Employees can access their own email account 
in one of two ways: (1) they can access it locally in Morgan's offices; or (2) they can access it 
remotely through the hitemet. hi addition, Mr. Morgan, Ms. Wingate, and the office manager have 
"administrative rights" to access the email accounts of other employees. (Ex. B, Wingate 
Declaration, ^5.) 

Much of the information contained in Morgan's computer system is highly confidential to 
Morgan and/or to its clients. (Ex. B, Wingate Declaration, ^f 6.) 
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The Group Wise® software allows users to create a setting in the email system, known as a 
"rule," that acts upon email messages. Only people with password access to an email account can 
create a rule for the account. Thus, to create a rule in a particular Morgan email account, a person 
must sign on using a GroupWise® password (his/her own or someone else's) specific to that email 
account. (Ex. A, Rosenbaum Declaration, % 12.) As will become relevant later, both Murphy and 
Wiswell knew Ms. Wingate's email password. Moreover, as Morgan's former office manager. 
Murphy had access to the passwords of every Morgan employee. (Ex. B, Wingate Declaration, f 
7.) The only other people who knew Ms. Wingate's GroupWise® password were Mr. Morgan and 
Ms. Natalia Lamb, who is Morgan's current office manager and who discovered the creation of the 
email rule that is, in part, the basis for this lawsuit. (Ex. B, Wingate Declaration, f 7.) 

B. Morgan's Employment of Wiswell and Murphy 

Morgan hired Angela Murphy as a receptionist in September 1998. Murphy was promoted 
to office manager in September 1999, and was later promoted to a bookkeeper in June 2002. (Ex 
B, Wingate Declaration, % 8.) 

Morgan hired Susan Wiswell in April 2001 to work as a Certified Public Accountant to 
prepare and review tax returns. (Ex. B, Wingate Declaration, % 9.) 

On the night of June 2, 2005, after Morgan's office had closed for the day, Wiswell 
returned to the office, cleaned out her belongings, and left a resignation letter on Mr. Morgan's 
chair. Mr. Morgan discovered Wiswell' s resignation letter the next morning. Wiswell did not give 
any advance notice that she would be terminating her employment; her resignation was effective 
immediately. (Ex. B, Wingate Declaration, f 10.) 

On June 16, 2005, Murphy verbally informed Mr. Morgan and Ms. Wingate that she would 
be terminating her employment with Morgan in two weeks. Mr. Morgan asked Murphy if she 
would continue her employment with Morgan through August 15, 2005 to allow Morgan time to 
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find a replacement, as she was the only bookkeeper at the time, but Murphy refused, stating that 
her last day would be June 30, 2005. (Ex. B, Wingate Declaration, Tf 11 .) 

The next day, June 17, 2005, Murphy arrived for work at Morgan's offices. Despite having 
given two weeks notice, Murphy permanently departed Morgan's premises by approximately 
1 1 :30 a.m., without telling anyone she was leaving. (Ex. B, Wingate Declaration, f 12.) 

C. Defendants' Wrongful Acts 

After terminating her employment with Morgan, Wiswell became employed by 
Hildebrand, Limparis & Associates, CPAs, P.C, located at 1 17 W. Patrick Street in Frederick, 
Maryland. 

Morgan later discovered that before terminating their employment. Murphy and/or 
Wiswell had exceeded their authorization to access Morgan's email server. Specifically, Murphy 
and/or Wiswell signed onto Morgan's email server using the usemame and password of Mr. 
Morgan and Ms. Wingate and created a "rule" in each email account intended to cause copies of all 
incoming and outgoing email to be forwarded to one of Defendants' two Yahoo! email accounts, 
namely, notmuchman_01@yahoo.com andjohnjohnson_1974@yahoo.com. 

As a result of these forwarding rules, all email correspondence to and fi^om Ms. Wingate, 
including business-related correspondence with employees and clients as well as personal 
correspondence with family and friends, was forwarded by blind copy to one of these two Yahoo! 
accounts. The forwarding rule in Mr. Morgan's email account was inactive at the time it was 
discovered; it may or may not have ever been activated. 

The first email forwarded by blind copy to the Yahoo! accounts was sent at approximately 
8:37 a.m. on June 17, 2005. (Ex. B, Wingate Declaration, f 13.) As explained above, this was the 
same day that Murphy arrived for work in the morning and left by noon without telling 
anyone — -Murphy's last day at Morgan's office. 
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Because the email messages were forwarded by blind copy and the forwarding rule was 
located in a seldom-accessed part of her email account, Ms. Wingate did not know that copies of 
her email correspondence were being forwarded to these Yahoo! email accounts. Neither she nor 
Mr. Morgan had any reason to believe their email accounts had been tampered with in any way. 

On or about June 27, 2005, while looking through the "Sent" email folder in her email 
account, Ms. Wingate discovered that more than 300 of her email messages had been forwarded by 
blind copy to the email account notmuchman_01@yahoo.com, and she informed Ms. Lamb. (Ex. 
B, Wingate Declaration, f 13.) Upon further investigation, Ms. Lamb discovered that forwarding 
rules for the two Yahoo! email accounts had been created in the email accounts of Ms. Wingate 
and Mr. Morgan. At the time it was discovered, the forwarding rule in Mr. Morgan's account was 
inactive. (Ex. C, Lamb Declaration, f 6.) 

Morgan deactivated the forwarding rale in Ms. Wingate's account, but did not delete the 
forwarding rule in either account. (Ex. C, Lamb Declaration, % 6.) It kept the now-inactive rales in 
its system while it investigated the situation. Suspecting that Murphy and/or Wiswell had created 
the forwarding rales, Morgan disabled the NetWare® passwords used by Murphy and Wiswell to 
access Morgan's computer network, but inadvertently failed to disable the Group Wise® passwords 
that Murphy and Wiswell had used to gain remote access to Morgan's email system through the 
Internet. (Ex. C, Lamb Declaration, f 8.) 

Unbeknownst to Morgan, Defendants were able to access Morgan's email system remotely 
through the Internet using Group Wise® passwords, even after Morgan had disabled the NetWare® 
passwords used by Murphy and Wiswell to access Morgan's computer network. (Ex. A, 
Rosenbaum Declaration, f 8.) Shortly after the forwarding rales had been discovered and 
deactivated, Defendants obtained remote access to the email accounts of both Ms. Wingate and 
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Mr. Morgan through the Internet, without authorization, and deleted the forwarding rales. (Ex. C, 
Lamb Declaration, f 7.) 

Defendants also continued to use Wiswell's and/or Murphy's usemame and password to 
log into Morgan's email system from outside Morgan's offices, through remote Internet access, 
even though their employment had terminated. For example. Defendants remotely accessed 
Wiswell's old email account at Morgan on the evening of July 7, 2005, more than a month after 
Wiswell resigned, and read a confidential email that one of Morgan's clients had sent to Mr. 
Morgan and Wiswell that same day. Defendants forwarded the email from Wiswell's email 
account at Morgan to the notmuchman_01@yahoo.com email account. Ms. Wingate later 
discovered the forwarded email when checking for client-related email in Wiswell's employee 
email account. This is done routinely when an employee leaves to ensure that all client matters are 
attended to. (Ex. B, Wingate Declaration, f 14.) Defendants were not authorized to access 
Wiswell's or Murphy's email accounts on Morgan's email system after Wiswell and Murphy 
terminated their employment with Morgan. 

After Wiswell and Murphy terminated their employment. Defendants also appear to have 
signed on to Ms. Wingate's email account and deleted emails from job applicants who might have 
replaced Wiswell and/or Murphy. Copies of email messages sent to Ms. Wingate's email account 
at Morgan are automatically forwarded to Ms. Wingate's Blackberry wireless email device. After 
receiving forwarded email messages from job candidates on her Blackberry, however, Ms. 
Wingate discovered that the original emails had been deleted from her email account at Morgan. 
(Ex. B, Wingate Declaration, f 15.) Murphy and Wiswell were never authorized to sign on to Ms. 
Wingate's email account and read or delete her emails. 

By signing on to Morgan's email server, accessing confidential client-related email 
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messages, and forwarding such messages to the Yahoo! email accounts, Defendants obtained 
unauthorized access to Morgan's computer system, its email server, and the electronic messages 
and documents stored in Morgan's system. By creating the rale in Mr. Morgan and Ms. Wingate's 
email accounts and by accessing, reading, and deleting emails in Ms. Wingate's account, 
Defendants exceeded any authorization that Wiswell or Murphy had to access Morgan's email 
system, either before or after they terminated their employment with Morgan. 

On or about July 14, 2005, Morgan disabled the Group Wise® passwords that Defendants 
had used to access Morgan's email system, and instracted all of its employees to change their 
email passwords as well. (Ex. B, Wingate Declaration, % 16.) Defendants were thus prevented 
from accessing Morgan's email system, even remotely through the hitemet. 

Since that time, Defendants have made more than 110 attempts to hack into Morgan's 
email system. (Ex. C, Lamb Declaration, f 4.) An investigation of Morgan's server access logs 
revealed that, after Morgan's employees changed their passwords. Defendants made — and 
continue to make — repeated attempts to access Morgan's email system by using the usemames 
and invalid passwords for Murphy, Wiswell, Ms. Wingate, Mr. Morgan, Ms. Lamb, and Ms. Marci 
Vergillo (Morgan's receptionist). (Ex. A, Rosenbaum Declaration, %^ 14, 16; Ex. C, Lamb 
Declaration, f 4.) Copies of these server access logs are attached as Exhibit 1 to the Declaration of 
Natalia Lamb and as Exhibits 2, 6, and 7 to the Declaration of Alex Rosenbaum. These failed 
attempts were not made by Morgan's employees; none of those employees made unsuccessfiil 
attempts to log into Morgan's email system at those times. (Ex. B, Wingate Declaration, % 3; Ex. 
D, Morgan Declaration; Ex. E, Vergillo Declaration; Ex. C, Lamb Declaration, f 3.) It is likely 
that these attempts to hack into Morgan's email system were made using a password cracker 
program because there are multiple login attempts made in very short intervals (i.e., five attempts 
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per usemame within a period of approximately 26 seconds). (Ex. A, Rosenbaum Declaration, ff 
14, 16.) These attempts are being made from a computer located at Wiswell's current place of 
employment. (Ex. A, Rosenbaum Declaration, %% 14, 16.) Server access logs showing these 
multiple attempts within very short time intervals are attached as Exhibit 6 to the Declaration of 
Alex Rosenbaum. 

As a result of its investigation, Morgan only recently discovered that Defendants have been 
accessing or attempting to access Morgan's email system for eight weeks now, with the most 
recent attempt made on August 1, 2005. (Ex. C, Lamb Declaration, % 9; Ex. A, Rosenbaum 
Declaration, f 21.) During all or part of that time, Defendants could have accessed, read, deleted, 
copied, altered, or transmitted virtually any document in Morgan's computer system, especially 
since Murphy had the ability (but not the authorization) to access all Morgan's email accounts and 
documents because of her former position as office manager. Any such access by Defendants 
would be unauthorized. 

Because Morgan performs accounting work for some clients only periodically, such as 
quarterly or annually, it may not discover on its own if Murphy and Wiswell have stolen or deleted 
client information until the next time Morgan performs work for such clients, if at all. Under the 
circumstances, it would be extremely expensive and time consuming for Morgan to attempt to 
make such a determination now, on its own, and there is no guarantee that Morgan would discover 
all of the information that Murphy and Wiswell may have stolen or deleted. (Ex. B, Wingate 
Declaration, f 17.) As such, the only effective remedy available to Morgan is to conduct discovery 
of the files and computer hard drives used by Murphy and Wiswell at home and at their current 
employers, on an expedited basis in order to prevent the loss or deliberate destruction of evidence. 

Murphy has also caused problems with one of Morgan's clients, for whom Murphy was the 
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primary bookkeeper, by making false statements to the client via email. On June 17, 2005, 
Murphy sent the client an email falsely stating that Mr. Morgan had demanded Murphy's 
resignation. In truth, Mr. Morgan made no such demand; Murphy tendered her resignation 
voluntarily without being asked to do so. (Ex. B, Wingate Declaration, % 18.) 

Wiswell has also been sending fictitious resumes and scheduling interviews with Morgan 
by email. An individual using the name "Tara Benedict" sent a resume by email to Ms. Wingate. 
According to the resume, "Tara Benedict" was purportedly employed by Watkins, Meegan, Drary 
& Company, L.L.C., and lived at 425 Kentlands Boulevard in Gaithersburg, Maryland. Ms. 
Wingate also received a resume and corresponded by email from an individual using the name 
"David Waskiewicz." Ms. Wingate arranged interviews with both individuals by email, but 
neither of them showed up. (Ex. B, Wingate Declaration, f 19.) 

Wingate later learned that no one named "Tara Benedict" was employed at Watkins, 
Meegan, Drary & Company, L.L.C., and that there was no such address on Kentlands Boulevard in 
Gaithersburg, Maryland. (Ex. B, Wingate Declaration, f 20.) She noted similarities, however, 
between "Tara Benedict" and Wiswell, such as the fact that Wiswell had previously been 
employed by Watkins, Meegan, Drary & Company, and previously lived in the Kentlands 
community in Gaithersburg, Maryland. (Ex. B, Wingate Declaration, f 20.) 

Upon investigation, Morgan discovered that the emails from "Tara Benedict" and "David 
Waskiewicz," and the numerous attempts to hack into Morgan's email system through the Internet, 
had all come from the same two Internet Protocol (IP) addresses (i.e., 67.20.56.21 1 and 
209.166.2.130). (Ex. A, Rosenbaum Declaration, f 20.) Morgan discovered that one of those IP 
addresses (i.e., 209.166.2.130) belongs to Wiswell's current employer (Hildebrand, Limparis & 
Associates), and that the other IP Address (i.e., 67.20.56.21 1) is linked to Wiswell's home 
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computer in Middletown, Maryland. (Ex. A, Rosenbaum Declaration, 1^ 14, 16-20.) Copies of 
documents showing the same two IP addresses for those emails and the repeated attempts to access 
Morgan's email system through the Internet are attached as Exhibits 6-13 to the Declaration of 
Alex Rosenbaum. A chart outlining the connection between these emails and failed attempts to 
log into Morgan's email system is attached as Exhibit 14 to the Declaration of Alex Rosenbaum. 

As reflected by their conduct in terminating their employment with Morgan on short or 
false notice, sending fictitious resumes to Morgan, scheduling bogus interviews, deleting emails to 
Ms. Wingate from legitimate job candidates, and relentlessly accessing and attempting to access 
Morgan's email system without authorization, and surreptitiously forwarding Plaintiffs 
confidential business information and client communications. Defendants' clear motive and 
purpose is to leave Morgan understaffed, to interfere with its ability to hire employees to replace 
Defendants, to steal or destroy Morgan's proprietary business information, to steal Morgan's 
clients, to damage Morgan's reputation, and ultimately to damage Morgan's ability to operate its 
business and serve its clients. 
III. ARGUMENT 

A. The Standard for Temporary and Preliminary Injunctive Relief 
This Court considers the same factors in ruling on a motion for a temporary restraining 
order and a motion for a preliminary injunction. Morgan Stanley DW Inc. v. Rothe , 150 F. Supp. 
2d 67, 72 (D.D.C. 2001). This Court issues a temporary restraining order or a preliminary 
injunction when the plaintiff demonstrates that: (1) there is a substantial likelihood plaintiff will 
succeed on the merits; (2) plaintiff will be irreparably injured if an injunction is not granted; (3) an 
injunction will not substantially injure the defendant; and (4) the public interest will be furthered 
by an injunction. Id. No one factor is dispositive; rather, the factors must be balanced against each 
other on a sliding scale. Id. A particularly strong showing on one factor may compensate for a 
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lesser showing on one or more of the other factors. Id A strong showing of Hkely success on the 

merits may warrant issuance of prehminary injunctive reHef even if the plaintiff makes a less 

compelling showing on the other three factors. Id. at 72-73. 

In this case, Morgan's likelihood of success on its claims is so great that even a modest 

showing of irreparable harm is sufficient to support temporary and preliminary injunctive relief 

Yet the risk to Morgan's reputation, goodwill, business operations, and client relations is also so 

great as a result of Defendants' deliberate and ongoing attempts to inflict injury on their former 

employer that the potential irreparable injury to Morgan alone justifies a temporary restraining 

order and a preliminary injunction. 

B. Morgan Has a Substantial Likelihood of Success 
on the Merits of its Claims 

The Court is not required to find that ultimate success by the plaintiff is probable, only 
substantially likely. Id at 72. Under the facts of this case, however, Morgan's ultimate success on 
its claims is a virtual certainty. Although it is likely to succeed on all of its claims, Morgan 
addresses only some of its claims in this Memorandum, for the sake of brevity. A substantial 
likelihood of success on any one of Morgan's claims, however, is sufficient to warrant temporary 
and preliminary injunctive relief 

1. Defendants Violated the Computer Fraud and Abuse Act 

Section 1030(a) of the Computer Fraud and Abuse Act makes it a crime to cause or attempt 
to cause damage by intentionally accessing a protected computer without authorization, and, as a 
result of such conduct, cause one or more persons loss of at least $5,000 in a one-year period. 18 
U.S.C. § 1030(a)(5)(A)(iii) and (B)(i). The Act provides the injured person with a civil cause of 
action against the violator to obtain injunctive relief, compensatory damages, and other equitable 
relief 18 U.S.C. § 1030(g). 
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Defendants have clearly violated the Act's provisions. Morgan's computer network and its 
email system are maintained on computers that are used in interstate commerce and 
communication, and therefore are "protected computers" within the meaning of the Act. See 18 
U.S.C. § 1030(e)(2)(B). Defendants' accessed Morgan's computers without authorization or in 
excess of their authorization. Specifically, they: 

(1) accessed the email accounts of Mr. Morgan and Ms. Wingate and created 
forwarding rules; 

(2) accessed the email account of Ms. Wingate and deleted emails from job 
candidates; and 

(3) used the passwords of Wiswell, Murphy, and other Morgan employees to 
access Morgan's email system and, thereafter, forwarded emails and 
deleted the forwarding rules, all after Wiswell and Murphy terminated their 
employment. 

See 18 U.S.C. § 1030(a)(5)(A)(iii). By forwarding the email from Wiswell's account and by 
creating and activating the forwarding rale in Ms. Wingate's account, Defendants also knowingly 
caused the transmission of information. See 18 U.S.C. § 1030(a)(5)(A)(i). 

These acts each caused "damage" within the meaning of the Act because they impaired the 
availability of information stored on the computers (by deleting emails) and impaired the integrity 
of Morgan's email system (by creating and deleting the forwarding rules and compromising the 
privacy and security of the system). See 18 U.S.C. § 1030(e)(8). 

In each case. Defendants' access or transmission was intentional and unauthorized. 
Neither Wiswell nor Murphy was ever authorized to access Mr. Morgan's and/or Ms. Wingate's 
email accounts for the purpose of deleting emails or creating (and then deleting) forwarding rales. 
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Moreover, after terminating their employment, Wiswell and Murphy did not have authorization to 
access or to attempt to access their email accounts at Morgan for any purpose, including 
forwarding client emails to private Yahoo! accounts. Defendants' acts violated Morgan's 
established policies and practices, and exceeded any authorization Wiswell or Murphy ever had. 

Finally, as a result of Defendants' conduct, Morgan has already incurred losses that exceed 
the $5,000 jurisdictional amount. The Act defines the term "loss" to mean "any reasonable cost to 
any victim, including the cost of responding to an offense, conducting a damage assessment, and 
restoring the data, program, system, or information to its condition prior to the offense, and any 
revenue lost, cost incurred, or other consequential damages incurred because of interruption of 
service." 18 U.S.C. § 1030(e)(l 1). In the short time since discovering Defendants' unauthorized 
access, Morgan has incurred — and continues to incur — costs for responding to Defendants' 
offense, hiring a computer forensics expert and assessing the extent of the damage, and restoring 
its computer system to the condition that existed prior to Defendants' offense. Those costs alone 
exceed $5,000 in value. In addition, Morgan has lost revenue and incurred damages as a result of 
lost work time and interruption in its business operations as a result of Defendants' acts. 

It is thus clear, even at this early stage, that Defendants' misconduct satisfies all of the 

elements for a civil cause of action under the Computer Fraud and Abuse Act. Morgan has met its 

burden to show a substantial likelihood of success on its claim, and is entitled to immediate and 

much-needed injunctive relief 

2. Defendants Violated Two Separate Provisions of the 
Electronic Communications Privacy Act 

Defendants have violated two separate provisions of the Electronic Communications 
Privacy Act by intentionally and without authorization (1) intercepting Morgan's electronic 
communications, and (2) accessing Morgan's stored electronic communications. 
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(a) Defendants Intentionally Intercepted Electronic 
Communications in Violation of 18 U.S.C. § 2511 

The evidence of Defendants' blatant and willful interception of Morgan's electronic 
communications is overwhelming. Morgan can and will show that Defendants (1) intentionally 
intercepted, endeavored to intercept, or procured another person to intercept or endeavor to 
intercept (2) the contents of an electronic communication (3) using a device. See 18 U.S.C. § 
251 l(l)(a); In re Pharmatrak. Inc. , 329 F.3d 9, 18 (1st Cir. 2003); see also 18 U.S.C. § 2520 
(creating a private right of action for violations of 18 U.S.C. § 2511). Specifically, Defendants: 

(1) accessed the email accounts of Mr. Morgan and Ms. Wingate and created 
forwarding rules without authorization; and 

(2) routed incoming and outgoing electronic communications from the email 
account of Ms. Wingate and possibly Mr. Morgan to two separate Yahoo! 
accounts. 

Defendants' interception of Morgan's email messages is a clear violation of the statute. 
First, Defendants' interception was intentional. See In re Pharmatrak, Inc. , 292 F. Supp. 2d 263, 
266 (D. Mass. 2003) (finding that § 251 1 applies to intentional interception of electronic 
communications). Defendants purposefully created forwarding rules in Morgan's email system 
for the express purpose of routing incoming and outgoing email correspondence to Defendants' 
Yahoo! email accounts. Defendants' acts were neither inadvertent nor benign, but rather were 
undertaken with a malicious intent to intercept highly confidential communications and 
documents being exchanged among Morgan's personnel and between Morgan and its clients and 
prospective employees. 

Second, Defendants' routing of Morgan's emails is an unauthorized interception. 
Unauthorized use of automatic routing software to intercept electronic communications in transit, 
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such as the Defendants' creation of the forwarding rules in Morgan's Groupwise email system, is a 
clear violation of the statute. See United States v. Steiger , 318 F.3d 1039, 1050 (1 1th Cir. 2003) 
(noting that "very few seizures of electronic communications from computers will constitute 
'interceptions' . . . unless some type of automatic routing software is used (for example, a duplicate 

of all of an employee's messages are automatically sent to the employee's boss) ") (citations 

omitted); hi re Pharmatrak, Lie , 329 F.3d at 22 (same). 

Finally, Defendants intercepted the contents of an electronic communication using a 
device. Without Morgan's consent, Defendants used routing software on a computer to create the 
forwarding rales that intercepted email during the transmission to and from Morgan. Defendants 
thus used a device to cause the interception of electronic communications. As a result of the 
interception, the contents of the electronic communications were disclosed to Defendants. By 
their acts, Defendants ensured that Morgan's email messages in their entirety, including any 
documents attached to the email messages, would be copied to Defendants' Yahoo! email 
accounts, thereby disclosing the contents of such messages (at a minimum, the name of the sender 
and the subject and date of the communication, even for unopened emails). 

Given the facts, Morgan is substantially likely to show that Defendants violated section 

251 l(l)(a) of the Electronic Communications Privacy Act. 

(b) Defendants Accessed Stored Electronic Communications in 
Violation of 18 U.S.C. § 2701 et seq. 

Defendants also intentionally accessed electronic communications stored on Morgan's 
computer server, without authorization, and obtained, altered, and prevented access to such emails. 
See 18 U.S.C. § 2701(a). See Sherman & Co. v. Salton Maxim Housewares. Inc. . 94 F. Supp. 2d 
817, 820 (E.D. Mich. 2000); see also 18 U.S.C. § 2707 (creating a private right of action for 
violations of 18 U.S.C. § 2701). 
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Defendants' unauthorized access to Morgan's computer network and email system is in 
clear violation of the statute. Defendants: 

(1) accessed email accounts stored on Morgan's computer server using the 
passwords of Wiswell, Murphy, and Morgan employees, without 
authorization; 

(2) accessed Ms. Wingate's email account and deleted emails from job 
candidates; and 

(3) forwarded emails and used and deleted the forwarding rules, all after 
Wiswell and Murphy terminated their employment. 

Morgan's computer server and email system form an electronic communications service. 
Defendants accessed Morgan's server and email system by using the usemames and passwords of 
Wiswell, Murphy, and Morgan employees, and were thus able to access stored email and other 
documentation. Moreover, even after such access was denied. Defendants continued to attempt to 
hack into Morgan's email system using its employees' usemames and invalid passwords. The 
statute clearly prohibits this type of activity. See State Wide Photocopy Corp. v. Tokai Fin- 
Services. Inc. , 909 F. Supp. 137, 145 (S.D.N. Y. 1995) ("[T]he ECPA was primarily designed to 
provide a cause of action against computer hackers, (i.e., electronic trespassers)."). Defendants 
thereby attempted to gain, and did gain, access to Morgan's computer server, its email system, and 
the contents of various stored electronic communications, some of which Defendants altered or 
deleted. 

Defendants' access was unauthorized and intentional. Defendants willfully and 
deliberately attempted to gain, and did gain, access to Morgan's email system even after Wiswell 
and Murphy terminated their employment with Morgan. Defendants did not have authorization to 
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use the usemames and passwords of Morgan's employees or to access Morgan's email system. 
See Sherman & Co. , 94 F. Supp. 2d at 821 ("[For] 'intentional' access in excess of authorization to 
be a crime and actionable civilly, the offender must have obtained the access to private files 
without authorization (e.g., using a computer he was not to use, or obtaining and using someone 
else's password or code without authorization."); In re American Airlines, Inc. Privacy Litigation , 
370 F. Supp. 2d 552, 558 (N.D. Tex. 2005) ("The purpose of § 2701 is to prevent unauthorized 
access to a facility through which an electronic communication service is provided."). 

Given the facts, Morgan is substantially likely to show that Defendants violated section 
2701(a) of the Electronic Communications Privacy Act. 

3. Defendants Trespassed on Morgan's Personal Property 

Trespass to personal property may be committed by intentionally ( 1 ) dispossessing another 
of the property, or (2) using or intermeddling with property in the possession of another. 
Restatement (Second) of Torts § 217 (1965). See Pearson v. Dodd , 410 F.2d 701, 707 n.30 
(D.C. Cir. 1969) (following the RESTATEMENT (SECOND) OF ToRTS); Daily v. Exxon Corp. , 930 F. 
Supp. 1, 2 (D.D.C. 1996) (same). Defendants trespassed on Morgan's personal property by: 

(1) accessing the email accounts of Mr. Morgan and Ms. Wingate and creating 
forwarding rules, without authorization; 

(2) accessing email accounts stored on Morgan's computer server using the 
passwords of Wiswell, Murphy, and Morgan employees, without 
authorization; 

(3) accessing Ms. Wingate' s email account and deleting emails from job 
candidates; 

(4) forwarding emails and using and deleting the forwarding rules, all after 
Wiswell and Murphy terminated their employment; and 
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(5) causing Morgan to spend substantial time and resources to determine the 
extent of damage and infiltration of Morgan's computer system. 

Defendants' willful interception of, and unauthorized access to, email messages on 
Morgan's computer server constitutes a trespass onto Morgan's personal property. Defendants 
intentionally and without authorization logged into Morgan's computer system from an external 
computer. In the networked computer environment, such electronic signals generated and sent by 
a computer are sufficient to support a claim for trespass. See CompuServe Inc. v. Cyber 
Promotions, fac . 962 F. Supp. 1015, 1021 (S.D. Ohio 1997) (transmission of bulk e-mails 
constitutes trespass); Thriftv-Tel. Inc. v. Bezenek , 46 Cal. App. 4th 1559, 1566-67 (Cal. Ct. App. 
1996) (electronic signals sent by computer support a claim of trespass); State v. McGraw , 480 N.E. 
2d 552, 554 (hid. 1985) (stating that a hacker's unauthorized access to a computer was a trespass). 

In addition. Defendants reviewed commercially important documents and manipulated 
Morgan's computer system to send automatically, and archive, copies of Mr. Morgan's and Ms. 
Wingate's email messages to Defendants' two Yahoo! email accounts, and deleted emails from 
Ms. Wingate's email account. As a result of Defendants' acts, Morgan has been damaged by the 
impairment of its computer resources and the disclosure of its proprietary business information. 
See CompuServe Inc. . 962 F. Supp. at 1022 (finding that the value of plaintiff s computer 
equipment is diminished, even if not physically damaged, by defendant's use of electronic 
mailings that demand disk space and drain the computer's processing power). In addition, Morgan 
has expended substantial time and resources to determine the extent of the damage to its computer 
system, to identify and — if possible— recover deleted emails, and to determine the extent to which 
its proprietary information has been stolen, copied, disclosed, or destroyed. 

Morgan is thus substantially likely to show that Defendants trespassed on Morgan's 
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personal property in violation of the common law of the District of Columbia. 

C. Morgan Will be Irreparably Injured if an Injunction 
Is Not Granted to Stop Defendants' Wrongful Acts 

Defendants' conduct has already irreparably injured Morgan by compromising Morgan's 
business reputation and goodwill, as well as the security and integrity of confidential financial 
information entrusted to Morgan by its clients. Defendant Murphy has made false statements to at 
least one customer regarding the reasons for her departure from Morgan, and such statements have 
adversely affected Morgan's relationship with that client. Defendant Wiswell also forwarded to 
one of the Yahoo! accounts at least one confidential communication from one of Morgan's clients, 
indicating an intent to steal such client. The illegal rule has forwarded hundreds of additional 
emails proprietary to Morgan. Defendants have also deleted emails from Morgan's legitimate job 
candidates. 

Morgan will also suffer additional irreparable injury if Defendants' conduct is not 
immediately enjoined. Defendants' password cracker hacking software could breach Morgan's 
computer security at any time. If and when this happens, all of Morgan's confidential and client 
information will be exposed. 

Thus, Defendants have already created customer-relations problems with at least one of 
Morgan's clients, and have accessed proprietary business and customer information that could 
lead to (indeed, may have already led to) the injury or loss of other client relationships. Unless 
enjoined, such conduct will cause Morgan fiirther irreparable harm. See Morgan Stanley , 150 F. 
Supp. 2d at 78 ("The plaintiff has persuaded the court that it would likely suffer irreparable harm in 
the loss of its customers and by the possibly permanently damaged relationships with its 
customers."); Equus . 2002 U.S. Dist. LEXIS 13539, at *13 (finding that, if allowed to continue 
during the pendency of the litigation, the defendant's unauthorized use of customer passwords to 
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access the plaintiffs website and download the plaintiffs business and customer information 
would cause irreparable harm to, or the loss of, the plaintiffs "valuable customer relationships"). 

Immediate injunctive relief is especially necessary in light of Defendants' relentless and 
ongoing efforts to hack into Morgan's email system. As detailed above, Defendants' efforts to 
break into the email accounts of Morgan's employees continues on an almost daily basis, even 
eight weeks after Wiswell terminated her employment with Morgan. As the number and 
frequency of their attempts demonstrate. Defendants will not stop in their efforts to hack into 
Morgan's email system until they succeed, unless enjoined by this Court. The mere threat that 
such conduct poses to Morgan's confidential and proprietary business information is alone 
sufficient to show irreparable harm justifying injunctive relief See Equus , 2002 U.S. Dist. LEXIS 
13539, at 12-13 ("The mere threat of misappropriation of trade secrets constitutes irreparable harm 
and warrants injunctive relief"). 

As the facts clearly demonstrate, Morgan is entitled to, and in need of, immediate 
injunctive relief Absent such relief, Morgan will suffer further irreparable harm. 

D. An Injunction Will Not Substantially Injure the Defendants 

The injunctive relief Morgan seeks will cause little if any harm to any legitimate interests 
Defendants' may have. While Defendants no doubt wish to continue their unlawful activities, 
there is no cognizable harm to Defendants from being enjoined fi-om infringing Morgan's rights; 
such harm is not considered in weighing the burden of granting injunctive relief See Blue Cross & 
Blue Shield Mut. of Ohio v. Blue Cross & Blue Shield Ass'n , 11 F.3d 3 1 8, 334 (6th Cir. 1 997); 
Forrv v. Neundorfer , 1987 U.S. Dist. LEXIS 3320, at *25 (N.D. Ohio, April 9, 1987), affd, 837 
F.2d 259 (6th Cir. 1988) ("[DJefendants having created this problem, they will not now be heard to 
bemoan that they are hoist with their own petard"). See also Midwest Guaranty Bank v. Guaranty 
Bank, 270 F. Supp. 2d 900, 924 (E.D. Mich. 2003) (a defendant "cannot place itself in harms way, 
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and then later claim that an injunction should not issue because of costs which it must incur in 
order to remedy its own misconduct"). 

The harm to Defendants of ceasing their unlawful conduct cannot weigh in favor of 
denying protection to Morgan for Defendants' unlawfiil acts. Defendants cannot claim any 
legitimate right to access Morgan's email correspondence or business and client information. 
Likewise, Defendants cannot claim any legitimate right or interest in sending false resumes or 
arranging bogus interviews with Morgan's employees, or deleting emails from legitimate 
employment candidates. 

In sum, Morgan seeks "to return to the status quo" by requiring the Defendants "to return 
[or destroy] all confidential data it has allegedly wrongfully diverted" from Morgan, and to refrain 
from continuing to engage in such activities in the future. Morgan Stanley , 150 F. Supp. 2d at 80. 
To the extent there is any cognizable harm to any legitimate interests Defendants may have, the 
potential injury to such interests is minimized by the fact that, because "the injunction sought is 
prohibitory in nature, no onerous affirmative obligations are placed upon [Defendants]." hire 
Richmond Paramedical Services, hic . 94 B.R. 881, 885 (Bankr. D. Va. 1988). 

E. An Injunction Will Serve the Public Interest 

The public interest favors protecting legitimate business interests and preventing unfair 
competition and commercial piracy. See Morgan Stanley , 150 F. Supp. 2d at 79; Equus Computer 
Svs. V. N. Computer Svs. , 2002 U.S. Dist. LEXIS 13539, at *13 (D. Minn. 2002). hi addition, the 
public has an interest in safeguarding the privacy and confidentiality of business communications. 
See Morgan Stanley , 150 F. Supp. 2d at 79. Moreover, the public has an interest in protecting 
trade secrets and other confidential information, an interest reflected by the adoption of the D.C. 
Uniform Trade Secrets Act. Id. Finally, the public has an interest in preventing the disclosure of 
the confidential financial information and communications of Morgan's clients. See Equus 
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Computer Sys. v. N. Computer Svs. , 2002 U.S. Dist. LEXIS 13539, at *13 (D. Minn. 2002) 
(finding that the pubHc interest favors an injunction to stop defendant from using passwords to 
access plaintiffs website and download plaintiffs business and customer information, and to 
prevent the disclosure of customer-related information). The public has no interest in destroying 
contracts, rewarding theft, and encouraging unethical business behavior. Morgan Stanley , 150 F. 
Supp. 2d at 79. 

Defendants' conduct, as detailed above, clearly shows a pattern of relentless conduct that 
demonstrates a blatant disregard for, and a clear risk to, these important public interests. Unless 
enjoined. Defendants will persist in their unlawful efforts to interfere with Morgan's business 
operations, steal or delete its proprietary information, eavesdrop on its communications, and 
potentially disclose, destroy, or exploit the confidential financial information of its clients. 

By granting the requested injunctive relief, this Court will serve and protect these 
important public interests, without harming any legitimate interest that Defendants' may have in 
engaging in such unethical business behavior. 

IV. CONCLUSION 

For the foregoing reasons, Morgan respectfully requests that this Court grant Morgan's 

motion for a temporary restraining order and schedule a hearing on, and thereafter grant, Morgan's 
motion for preliminary injunction. 
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